Possible wrong calculation of locked balance

[code423n4]

Handle

a_delamo

Vulnerability details

Impact

First, I am not sure if this is an actual implementation issue or the protocol should behave like this.

In Visor.sol, there is getBalanceLocked function used for multiple calculations. Checking at the implementation seems like instead of doing a sum of all the locked amount is looking for the biggest locked amount.

    function getBalanceLocked(address token)
        public
        view
        override
        returns (uint256 balance)
    {
        uint256 count = _lockSet.length();
        for (uint256 index; index < count; index++) {
            LockData storage _lockData = _locks[_lockSet.at(index)];

            if (_lockData.token == token && _lockData.balance > balance)
                balance = _lockData.balance;
        }
        return balance;
    }

Tools Used

None

[ghost]

sponsor disputed protocol should behave like this

[ghoul-sol]

It’s a feature so marking as invalid